MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b043532b3c8d15a45a2f44a72fccad182e5807e7c5aadf943f1a3a27210a159c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DonutLoader

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	b043532b3c8d15a45a2f44a72fccad182e5807e7c5aadf943f1a3a27210a159c
SHA3-384 hash:	8f0d50be3016f8ebe71b61a4f304c7559bc80db42bf012e3a81faf001b1d38e8ac82f8e9830cfbfaec12439a6eceaeae
SHA1 hash:	0f2d6c2f975c86bb28231c227b22f31be22682db
MD5 hash:	ffd54028abe509b8808e659c3f9ae590
humanhash:	minnesota-saturn-potato-nevada
File name:	i.ps1
Download:	download sample
Signature	DonutLoader Create hunting rule
File size:	64 bytes
First seen:	2025-07-12 18:38:40 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	3:ThhWdGKT3ROgsfRNAwhfIWqn:VhURdsfLbG9
Threatray	4 similar samples on MalwareBazaar
TLSH	T111A0220B0823008CA0C202B0C20028CE338232EAB00F2020BCAA02E0020002FA300822
Magika	txt
Reporter	GDHJDSYDH1
Tags:	donutloader Downloader injector lumma LummaStealer ps1 stealer

Intelligence

File Origin

# of uploads :

# of downloads :

118

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6872abd8900df8e7f86a40b6

Tags:

autorun emotet

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6872abe1a15b22faa8afb728/reports/b0e5bfbb-9c71-44b8-92ba-402e28ba7735/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/b043532b3c8d15a45a2f44a72fccad182e5807e7c5aadf943f1a3a27210a159c

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b043532b3c8d15a45a2f44a72fccad182e5807e7c5aadf943f1a3a27210a159c

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b043532b3c8d15a45a2f44a72fccad182e5807e7c5aadf943f1a3a27210a159c/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wbbvgkz4ruk2iwrpists7tfndaxfqb7hywvn7fb7di5coiikcwoa._file

Verdict:

malicious

Label(s):

lummastealer

donut_injector

DonutLoader

b8ef3a8efd03abacf7d711c0cc698fe95fb2984e39c02e39b5993c02eaef9dbc

DonutLoader

error

DonutLoader

Result

Malware family:

donutloader

Score:

10/10

Tags:

family:donutloader discovery execution loader spyware

Link:

https://tria.ge/reports/250712-xaqzcsvkw4/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Browser Information Discovery

Command and Scripting Interpreter: PowerShell

System Location Discovery: System Language Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops startup file

Blocklisted process makes network request

Detects DonutLoader

DonutLoader

Donutloader family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/b043532b3c8d15a45a2f44a72fccad182e5807e7c5aadf943f1a3a27210a159c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)